Attack Chain

1. An attacker gains access to the nginx-ui dashboard, likely through valid credentials or exploiting an existing vulnerability.
2. The attacker navigates to the settings or preferences section of the nginx-ui.
3. The attacker crafts a POST request to the /api/settings endpoint with malicious settings modifications using tools such as Burp Suite.
4. The attacker floods the /api/settings endpoint with multiple concurrent requests to trigger the race condition.
5. Due to the lack of synchronization primitives, ProtectedFill() modifies shared global singleton pointers in an unsafe manner.
6. Concurrent write operations to app.ini interleave, causing file corruption with empty lines, truncated fields, or overwritten configuration keys.
7. The corruption of app.ini causes the application to either redirect to the /install page or encounter a fatal error during boot, leading to a denial of service.
8. If configuration sections become interleaved (e.g., nginx settings written into webauthn section), an attacker might inject a malicious payload into a command execution field such as ReloadCmd, achieving potential remote code execution upon the next nginx reload.

Impact

The race condition in nginx-ui can have significant consequences. The immediate impact is a persistent denial of service, rendering the application unavailable. The corruption of the app.ini file leads to loss of configuration integrity, making recovery through the web UI impossible. Furthermore, the potential for cross-contamination of INI values opens a non-deterministic path to remote code execution. Although the conditions for achieving RCE are dependent on the precise interleaving of thread execution, successful exploitation would allow an attacker to execute arbitrary commands on the server.

Recommendation

• Apply the patched version of nginx-ui (v2.3.4) available at https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 to remediate CVE-2026-33028.
• Monitor web server logs for multiple, rapid POST requests to the /api/settings endpoint to detect potential exploitation attempts.
• Implement a file integrity monitoring (FIM) system to detect unauthorized modifications to the app.ini configuration file using file_event logs.
• Deploy the Sigma rule to detect suspicious processes invoking the nginx -s reload command after settings modification to identify potential RCE attempts.